Capillary Technologies has received a final forensic audit report from KPMG confirming a payment-diversion fraud totaling EUR 3.04 million at its subsidiary, Session M Czech Republic. The audit clarifies the incident involved social engineering and executive impersonation rather than a system hack. Management is now reviewing the report to bolster internal verification and treasury protocols.
Capillary Technologies Receives Forensic Audit Report on Payment Fraud
EUR 3,041,169.90 involved in payment-diversion incident at subsidiary Session M Czech Republic.
KPMG report confirms no malware or system compromise, identifying fraud via social engineering and impersonation.
Reader Takeaway: Company IT systems remain secure, but management faces scrutiny over procedural gaps in executive verification and payment authorization.
What just happened
Capillary Technologies India Limited has received the final forensic audit report from KPMG regarding a cyber-enabled banking fraud. The incident involved four disputed payments made between June 26, 2026, and July 2, 2026. The investigation concluded that fraudsters utilized executive and legal impersonation to divert funds to accounts in Hong Kong and Singapore. The total financial impact is confirmed at EUR 3.04 million.
Why this matters
For investors, the key finding is that the company's internal IT infrastructure was not compromised. There is no evidence of malware or mailbox hacking. However, the report highlights a critical vulnerability in human-process controls. Fraudsters bypassed official channels by using WhatsApp and personal emails to exert urgency, exposing gaps in the company's treasury approval and beneficiary validation processes.
The backstory
The company previously disclosed the incident involving its step-down subsidiary, Session M Czech Republic. The forensic investigation, titled "Project Cluewire," was commissioned to determine the scope of the unauthorized outflows. The funds were traced to ZZDJB CO Limited (HSBC Hong Kong) and Zhongxian Trading Pte Ltd (UOB Singapore).
Risks to watch
Management must address the procedural weaknesses that allowed off-channel communications to influence high-value payments. The report notes that the current audit did not have access to personal mobile devices or complete bank-portal audit trails, meaning the full extent of the fraud mechanism—including the potential use of deepfake technology—remains partially unverified.
What to track next
The Board and Audit Committee are currently reviewing the recommendations. Investors should monitor future disclosures regarding updates to treasury protocols and whether the company is able to recover any of the diverted funds from the destination accounts.